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The Legislative Audit Committee 
ofthe Montana State Legislature: 


This is our report summarizing hotline and referral activity for fiscal year 2018. 


Ihe Legislative Audit Act requires the legislative auditor to establish and maintain a 
toll-free number (hotline) for reporting fraud, waste, and abuse in state government. 
Ihe Act further requires the Legislative Auditor to periodically report to the Legislative 
Audit Committee the use of the toll-free number, results of reviews, verifications, 
and referrals, and corrective actions taken by appropriate agencies. State agencies are 
also required to notify the Legislative Auditor upon discovery of any theft, actual or 
suspected, involving state money or property under that agency’s control. We report 
the results of our Financial-Compliance, Information System, and Performance audits 
throughout the year and these reports can include the results of hotline calls and 


referral work. 


This report provides the legislature a summary of all hotline and referral activity for 
fiscal year 2018 in one report. It includes work completed on submissions either during 
Financial-Compliance, Information System, or Performance audits, or independent of 
a scheduled audit. This report includes information on specific submissions and any 
referrals due to suspected criminal activity. 


Respectfully submitted, 
/s/ Angus Maciver 


Angus Maciver 
Legislative Auditor 


Room 160 ° State Capitol Building + PO Box 201705 + Helena, MT ° 59620-1705 
Phone (406) 444-3122 « FAX (406) 444-9784 + E-Mail lad@mt.gov 
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Legislative Audit Division 


REPORT SUMMARY 


Compliance, and 


Transparency Hotline provides citizens and state employees a mechanism 
to report suspected fraud, waste, or abuse of state government resources. 
This report to the Legislative Audit Committee provides information on the 
use of the hotline; the results of the reviews, verifications, and referrals; and 
any corrective action taken by the agency that was the subject of the report. 
There were 51 submissions to the hotline of potential fraud, waste, or abuse 
and agencies reported 17 discoveries of theft or suspected theft in fiscal year 


2018. 


Context 


This report summarizes activity submitted 
through the Legislative Audit Division's 
Accountability, Compliance, and Transparency 
(ACT) Hotline in fiscal year 2018. As required 
by statute, we describe information on the 
use of the hotline, the results of our reviews 
and verifications of the submissions, and any 
referrals to the attorney general during fiscal 
year 2018. 


A toll-free number was established in Montana 
at the Legislative Audit Division in 1993 for 
citizens and state employees to report potential 
fraud, waste, abuse, or theft of state property 
and resources. Since 1993 the ways individuals 
can make a report have changed. Today 
a person can anonymously make a report 
using the toll-free number, e-mail, United 
States Postal Service, web-based form, or text 
message. A dedicated group of Legislative Audit 
staff, the ACT Team, review each submission, 
and assign the submission to a team member or 
other staff who then analyzes the submission 
to determine its veracity. In fiscal year 2018, 
approximately 197 staff hours were dedicated 
to working on hotline submissions outside of 
ongoing audits. 


Agencies are also required to report the 
discovery of theft or suspected theft of state 
property. These are referred to as penal 
violations. While these are different from 
hotline submissions, they are also recorded in 
our case management system, reviewed, and 
assigned to staff if applicable. Agencies reported 
a total of 17 discoveries of theft or suspected 
theft in fiscal year 2018, which is substantially 
lower than the 35 reports received in fiscal year 
2017. 


Results 


Hotline submissions are reports of potential 
fraud, waste, or abuse of state of Montana 
resources. Staff analyze the submissions to 
determine the veracity of the allegations. 


Substantiated reports are those submissions 
where evidence was found by or provided 
to staff to support or prove the truth of the 
allegation. In an unsubstantiated report the 
allegation was not supported by evidence. 
An inconclusive investigation means that 
we could not come to a firm conclusion 
about the truth of the allegation. A no 
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jurisdiction designation means that we do 
not have authority over the subject matter 
of the allegation, such as a local or federal 
governmental issue. Or, in the alternative, 
the allegation was referred to another state 
agency hotline, such as the Department of 
Public Health and Human Services recipient 
fraud hotline, State Fund’s fraud hotline, or 
the Medicaid Fraud Integrity Unit or Ofhce 
of Consumer Protection at the Department 
of Justice. 


In certain instances, the allegation is referred 
to the agency that is the subject of the 
submission for appropriate action. In these 
cases, the agency responds in writing to the 
inquiry and provides any corrective action 
taken. Ihe table shows the number and types 
of submissions received in fiscal year 2018. 


Hotline Reports for FY18 


Substantiated reports Ei 
Unsubstantiated reports 
Inconclusive investigation | 9 | 


Renesa Je 
RAT | o | 
pe e PEA 


Source: Compiled by the Legislative Audit Division 


For a complete copy of the report (18ACTHotline) or for further information, contact the 
Legislative Audit Division at 406-444-3122; e-mail to lad@mt.gov; or check the web site at 


www.//leg.mt.gov/audit 
Report Fraud, Waste, and Abuse to the Legislative Auditors FRAUD HOTLINE 


Call toll-free 1-800-222-4446, or e-mail lad@mt.gov. 


Chapter I - Introduction 


Recent Hotline History 


Section 5-13-311, MCA, requires the Legislative Auditor to establish and maintain a 
mechanism for citizens to report fraud, waste, or abuse in state government; review 
and maintain a record of all submissions; analyze and verify the information received; 
or refer the information for appropriate action to the agency that is or appears to be the 
subject of the call. Ihe Legislative Audit Division (LAD) established a hotline in 1993 
and citizens or state employees were able to submit a report through a toll-free number. 
Later a dedicated e-mail address and an anonymous online fillable form were made 
available. LAD recorded and managed the submissions to the hotline in a database. 


In addition, $5-13-309, MCA, requires agency directors to report the discovery of 
any theft, actual or suspected, to LAD. These penal violations were also recorded and 
managed in the LAD database. This chapter provides background information on the 
importance of having an avenue to report allegations fraud, waste, and abuse in state 
government and a history of these efforts managed by LAD. 


Accountability, Compliance, and 
Transparency (ACT) Hotline 


A 2018 report from the Association of Certified Fraud Examiners point to the 
importance of organizations having tools in place that allow individuals to report 
potential misuse or fraudulent use of resources. For example, the 2018 report indicates 
organizations receive information from a variety of individuals regarding potential 
occupational fraud and over half these reports (53 percent) came from employees 
of the victim organization. This compares with 15 percent being identified by an 
organization's internal audit function. This illustrates the importance a tool like LAD's 
hotline can play in identifying fraud, waste, and abuse in Montana state government. 


We believe it is important to provide a focused, proactive approach to responding to 
hotline submissions and reported penal violations. It is also imperative to effectively 
and efficiently analyze and determine the veracity of the suspected fraud, waste, abuse, 
or penal violations in state government. As a result, LAD has made some substantive 
changes to this process in the past year. 


ACT Team Enhances Response to Reports 
of Suspected Fraud, Waste, and Abuse 


The Accountability, Compliance, and Transparency (ACT) Team within LAD was 
created to address the responsibilities established by statutes and standards as well as 
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enhance the response to suspected fraud, waste, abuse, or penal violations found by 
or reported to LAD. The four-to six-member team is a diverse group, comprised of 
individuals with varying levels ofexperience and knowledge and includes representatives 
from the Financial-Compliance, Information Systems, and Performance teams. The 
ACT team is organized under, reports to, and is led by LAD legal counsel. 


For the team to function more efficiently and track the submissions more effectively, 
LAD contracted with a vendor to provide a cloud-based case management system to 
replace the outdated database. This tool, which was implemented in March of 2018, 
is an effective and efficient platform to record, analyze, determine the veracity of, and 
resolve submissions to the hotline. The case management system also is the repository 
for penal violations reported to LAD and allows staff to analyze those reports as well. 
The case management system also provides analytics, trending, and benchmarking 
analysis. As illustrated by Figure 1 below, there are currently several ways a citizen or 
state employee can report a concern regarding alleged fraud, waste, or abuse in state 
government, including a toll-free phone number, e-mail, USPS, online reporting form, 
and text. 


Figure 1 
Reporting Tools for ACT Hotline 


Toll-Free phone number 
1-800-222-4446 

Local Helena number 
444-4446 


LADHotline@mt.gov 


Text2Tell LAD Fraud Hotline 


704-430-3930 f, Legislative Audit Division 
a PO Box 201705 


Helena, MT 59620-1705 


Online reporting 
https://actmt.ethix360.com 


Source: Compiled by the Legislative Audit Division. 


All reporting forms allow the reporter to remain anonymous and their information 
confidential. Additionally, $5-13-314, MCA, provides protection for employees of the 
state or authorized contractors from penalties, sanctions, retaliation, or restrictions in 
connection with their employment as a result of their disclosure of information to 
LAD or Legislative Audit Committee (LAC) as long as they have not violated state 
law. 


When a hotline submission is received, the ACT Team reviews and classifies the 
allegations and they are entered in the case management system. The team then 
recommends which staff should be assigned to analyze and test the veracity of the 
submission. One or more of the ACT Team members may act as case managers, 
overseeing the work done by staff, or the case may be assigned directly to an ACT 


Team member. 


Penal Violations and Criminal Referrals 


As previously stated, state law requires agencies to report the discovery of any theft, 
actual or suspected, to LAD. A penal violation (PV) may also be discovered during an 
audit or reported through the hotline. The ACT Team also reviews and classifies these 
types of submissions and determines if there is a need to obtain additional information 
for use in an ongoing or subsequent audit, assign staff to analyze the submission, or 
refer the issue to the attorney general and the governor, as required by state law. If such 
a referral is made, the legislative auditor is required to furnish the attorney general with 
all information available relative to the violation. Chapter V of this report provides 
information regarding these criminal referrals for fiscal year 2018. 


Report Contents 


The remainder of the report presents the usage of the hotline; the results of the reviews, 
verifications, and referrals; and any corrective actions taken by the appropriate agencies. 


+ Chapter II provides statistics about the use and results of the hotline. 


* Chapter III discusses substantiated hotline cases and corrective actions taken 
by the appropriate agency. 


+ Chapter IV presents select penal violations where staff obtained additional 
information or analyzed the submission. 


e Chapter V presents the criminal referrals made to the attorney general during 
fiscal year 2018. 
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Chapter II — Statistics 


Introduction 


The new ACT hotline case management database allows Legislative Audit Division 
(LAD) staff to store and track hotline and penal violation submissions. 


Hotline reports are allegations of potential fraud, waste, or abuse of state resources. In 
fiscal year 2018 there were a total of 51 hotline reports. This is up from 31 reports in 
fiscal year 2107. 


Penal violations (PV) are reports from agencies detailing the discovery of any theft, 
actual or suspected. Additionally, a PV may also be discovered during an audit or 
reported through the ACT hotline. In fiscal year 2018 there were 17 reported penal 
violations, approximately half of what was reported (35) in fiscal year 2017. The 
following figure illustrates the total hotline reports and PVs received by LAD in fiscal 
year 2018. 


Figure 2 
Total Submissions for FY18 


m Hotline Reports = Penal Violations 


Source: Compiled by the Legislative Audit Division 
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When a hotline report is received, LAD staff categorize the allegation based on the 
how the reporter describes the subject matter of the allegation. As the following figure 
shows, public assistance fraud is an allegation that a person receiving cash assistance 
for food or housing is misusing, is not qualified to receive, or is selling their benefit. 
These submissions are normally referred to the Department of Public Health and 
Human Services recipient fraud hotline. Abuse or waste of state resources include 
allegations such as spending funds on unnecessary or frivolous items or activities, 
unnecessary travel, and misusing state property, equipment, or vehicles. Ihe reporter is 
referred to another state, local, or federal entity when LAD has no jurisdiction over the 
subject matter of the allegation. The other category includes allegations of employees 
not adhering to specific state laws, administrative rules, policies, or procedures. The 
following figure depicts statistical information about the types of the 51 hotline 
submissions received in fiscal year 2018. 


Figure 3 
Type of Hotline Submissions for FY18 


5 = Public Assistance Fraud 


= Unlawful Hiring Practices 
2} = Inappropriate Purchasing 
= Abuse or Waste of State 


Resources 
= Misuse of Leave 


= Other 


14 | = No Jurisdiction 


= Theft 


Source: Compiled by the Legislative Audit Division 


LAD staff also assign the allegation to a state agency that is the subject of the 
submission. In fiscal year 2018, 19 agencies were the subject of hotline submissions: 
9 each for the Department of Public Health and Human Services and the Department 
of Corrections, and 5 for the Department of Labor and Industry. By comparison, in 
fiscal year 2017, 14 agencies were the subject of hotline submissions. Seven for the 
Department of Corrections, 6 for the Department of Transportation, and 5 for the 
Department of Public Health and Human Services. The following figure shows the 
state agencies that were the subject of the submissions and the number of submissions 
attributed to each agency for fiscal year 2018. 


Figure 4 
Hotline Submissions by Agency for FY18 


University of Montana 

UM Western 

Secretary of State 

Office of the State Auditor 

Office of the Public Defender 

Office of Public Instruction 

Non-State Entities 

MSU Northern 

Montana State Lottery 

Montana State Library 

Department of Transportation 

Department of Revenue 

Department of Public Health 8 Human Services 
Department of Natural Resources & Conservation 
Department of Labor & Industry 

Department of Fish, Wildlife 8 Parks 
Department of Environmental Quality 
Department of Corrections 

Department of Agriculture 

Department of Administration 


Source: Compiled by the Legislative Audit Division 
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After investigation by LAD staff, reports are categorized based on the evidence 
obtained and the ability of staff to corroborate the allegation. Substantiated reports 
are those submissions where evidence was found by or provided to staff to support or 
prove the truth of the allegation. In an unsubstantiated report, the allegation was not 
supported by evidence. An inconclusive investigation means that staff could not come 
to a firm conclusion about the truth of the allegations. A no jurisdiction designation 
means that we do not have authority over the subject matter of the allegation or the 
allegation was referred to another state agency hotline. 


The referred to agency designation means the submission was referred to the agency 
that is the subject of the submission for appropriate action. In these cases, the 
agency responds in writing to the inquiry and provides any corrective action taken. 
The following figure depicts the type of resolution that resulted from the work staff 
completed for each of the submissions. 


Figure 5 
Hotline Resolutions for FY18 


Æ Unsubstantiated E Referred to Agency 
E inconclusive Investigation ® Reports Still Under Investigaiton 
E No Jurisdiction E Substantiated 


11 9 9 


Source: Compiled by the Legislative Audit Division 


Penal Violations 


Penal violations (PV) are submissions from agencies to satisfy their statutory 
responsibility to report theft or suspected theft to the legislative auditor or may also be 
discovered during an audit or reported through the hotline. Thefts of property include 
computer equipment and tools. 


The 2 Pv’s in the other category were thefts that were not reported to law enforcement. 
In one case the property had very minimal value and in the second case the theft was 
not discovered for more than a decade. Figure 6 illustrates the types of PV received in 
fiscal year 2018. 


Figure 6 
Types of Penal Violations in FY18 


= Theft of Property 
= Theft of Cash 
= Other 


Source: Compiled by the Legislative Audit Division 
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In fiscal year 2018, 8 state agencies reported a total of 17 thefts of property or cash 
from their agency, with the universities and the Department of Fish, Wildlife, and 
Parks reporting nearly half (7) of the penal violations. By comparison in fiscal year 
2017, there were 35 reported PV’s. The universities reported the majority of the thefts 
(22) and the Department of Fish, Wildlife, and Parks reported 4 thefts. The following 
figure shows the state agencies that reported to LAD the discovery of any theft, actual 
or suspected, and thefts that were discovered through an audit or reported to the 
hotline for fiscal year 2018. 


Figure 7 
Penal Violation Submissions by Agency for FY18 


University of Montana 
Department of Fish, Wildlife & Parks 


Montana State University 
Department of Transportation 


Department of Natural Resource & Conservation 
Department of Labor & Industry 

Department of Environmental Quality 
Department of Corrections 


Source: Compiled by the Legislative Audit Division 


Chapter III-Substantiated Cases 


Introduction 


Reports to the hotline are confidential until the Legislative Auditor or other appropriate 
agency acts to verify the fraud, waste, or abuse reported and takes corrective action. 
The information concerning the subject of the complaint and the remedy, if any, then 
becomes public information, unless it is otherwise precluded by law from disclosure. 
The following are the substantiated cases reported to the Accountability, Transparency, 
and Compliance (ACT) hotline for fiscal year 2018. Substantiated reports are those 
submissions where evidence was found by or provided to staff to support or prove 
the truth of the allegation. In fiscal year 2018, Legislative Audit Division (LAD) staff 
substantiated a total of six hotline reports. 


Office of Public Defender Paying Court 
Filing Fees Found to be Waste 


During the representation of a client, an attorney with the Office ofthe Public Defender 
(OPD) may determine the substitution of the judge is in the best interest of their client. 
Statute requires the Motion for Substitution (motion) be filed within 10 calendar days 
after the defendant’s arraignment. Additionally, a $100 nonrefundable fee must be 
paid by OPD to the clerk of the district court in the applicable county within 30 days 
of receipt of the claim for substitution fee. In a hotline report, it was alleged, by a 
district judge, that OPD was wasting their finite resources on a process to obtain a 
different judge whom they perceived to be more favorable to their clients. LAD was 
provided five denied orders. All were denied on the basis that OPD had not met the 
statutory requirements set out above. 


We substantiated two of the five denied orders as waste of state resources. One motion 
was filed within the 10-day substitution period, but the clerk did not receive payment 
within the 30 days. Additionally, one motion was filed outside the 10-day requirement. 
Based on our work, we believe these are anomalies and do not represent widespread 
waste on the part of OPD related to these types of motions. OPD made changes to 
its procedures to increase assurance these motions and payments are made on a timely 
basis. 


Department of Labor and Industry Approved 
Sick Leave for Incarcerated Employee 


This hotline submission alleged that a Department of Labor and Industry (DOLI) 
employee did not have enough annual or other appropriate leave to cover time 
incarcerated, so their supervisor entered sick leave on the time sheet in the employee’s 
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absence. In analyzing this submission, we determined the use of sick leave for an 
incarcerated employee was contrary to state sick leave policy, and is abuse of a paid leave 
of absence. DOLI staff agreed sick leave should not have been charged and provided 
documentation it had been corrected. 


Department of Corrections Employees 
Inappropriately Received Extra Pay 


We received an allegation that a Department of Corrections (DOC) employee added 
members to a special security team without going through the proper process. “The 
employee was also a member of this specialized team. In analyzing this hotline 
submission, we determined these team members receive an additional 50 cents per 
hour in pay, specialized training that takes them away from their primary duties, 
and special equipment. Because of the benefits provided, membership on these teams 
requires an application and competitive selection process. 


The Division of Criminal Investigation Bureau of the Department of Justice (DOJ) 
advised that the DOC investigations unit conduct an internal investigation with the 
possibility of a referral to the local county attorney. Therefore, we referred this to the 
DOC investigations unit. 


The investigation determined the employee had in fact added several members to 
the special security team without going through the required process. It was also 
determined these new members, collectively, received approximately $2,500 in pay 
they were not entitled to, but had not received any additional equipment or training. 
During the investigation, the employee indicated they had been authorized to add the 
new members from a high-ranking official of DOC. This statement was not able to be 
verified because that official was no longer employed by DOC. 


The employee was given a written warning and was removed from the team. The other 
employees were either removed from the team or voluntarily left the team and their 
pay increase was terminated. The DOC did not seek reimbursement from the team 
members for the additional amount of pay received as it was a minimal amount, and 


did not find them culpable. 


Montana State Prison Employees and Family 
Members Allowed to Hunt in Violation of Policy 


This hotline submission alleged that a Department of Corrections employee allowed 
other employees and their family members to archery hunt on a closed area of the 
Montana State Prison Ranch, commonly referred to as Ranch 2. Montana State 


Prison (MSP) internal policy allows archery hunting on ranch property under certain 
circumstances and requires the land use rules to be followed, or the hunter could 
lose their hunting privileges and license. This policy prohibits hunting on Ranch 2, 
and restricts hunting on other areas of ranch property. The Montana Correctional 
Enterprises (MCE) ranch hunting access rules require employees to obtain permission 
from the MCE administrator to hunt on ranch property. Employees must also follow 
the rules set out in MSP policy when hunting on ranch property, including accessing 


the ranch by checking in and checking out at the MSP checkpoint. 


We reviewed policies and interviewed MSP staff. Based on this work the allegations 
were substantiated. Employees and their family members were given permission to 
hunt on Ranch 2, which is prohibited. Further, on the days when those employees were 
hunting, they were doing so without the permission of the MCE administrator, and 
they gained access to the area through another road, not through the MSP checkpoint, 
as required. 


Fish, Wildlife, and Parks Property 
Being Used for Personal Use 


A hotline report was made alleging a Fish Wildlife and Parks (FWP) employee was 
using an FWP hangar to store personal property. This report was submitted to the 
DOJ Division of Criminal Investigation, forwarded to LAD, and analyzed by our 
staff. LAD staff substantiated this report as abuse through an on-site visit to the 
hangar. FWP staff were not able provide LAD staff access to the hangar, however staff 
did observe a private van parked next to the hangar. Audit staff gained access to the 
hangar on a second site visit and found a personal car top carrier present in the hangar 
and the personal van still parked next to the building. This was reported to FWP. 


FWP followed up on this report and confirmed a car top carrier present in the hangar 
and had it removed by the employee. FWP also verified there were no additional 
personal property being stored in the facility, and the van would be moved. FWP 
discussed the appropriate use of state property with the employee, issued a formal letter 
outlining expectations for state property, and will conduct periodic inspections of the 
hangar over the next year. FWP indicated this situation will be noted in the employee's 


performance agreement/evaluation. 


Personal Camper/Bus Parked on Montana 
Department of Transportation Property 


In this hotline submission, an individual reported a camper/bus was parked on 
Montana Department of Transportation (MDT) property, and was using electricity 
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paid for by the state. MDT indicated there was a lease agreement in place, and the 
employee was part of a construction crew in the area. MDT has lease agreements with 
several employees and contractors at construction sites around the state. 


LAD staff visited the site where the camper/bus was parked. Staff found the camper/ 
bus was on MDT property, and was plugged into the shop. MDT staff indicated the 
lease agreement was for $50 to park the camper/bus, but did not include electricity. 
MDT staff reviewed the case and identified several concerns. These included: the 
lease agreement was not completed and signed, the agreement did not address the 
circumstances, the amount being charged was not reasonable, the lease agreement was 
not treated as a taxable benefit, the agreement did not benefit MDT as intended, and 
MDT guidelines did not lead to consistent application of the rules. MDT took the 
following steps to address this issue: 


+  Notified the employee to vacate the premise. 


* Developed a policy on when to allow lease agreements, and require better 
documentation. 


* Developed a better lease agreement template. 
è Reviewed all existing agreements. 


+ Reviewed all employees with a taxable benefit, such as a lease agreement, and 
ensured the agreement with each employee was updated. 


LAD staff reviewed these steps, and determined they were sufficient to address this 


issue. 


Chapter IV - Select Penal Violations 


Introduction 


State law requires that agencies report to the legislative auditor and the attorney general 
the discovery of theft, actual or suspected, of state money or property under the 
agency's control. These reports are entered into the Accountability, Compliance, and 
Transparency (ACT) case management system and Legislative Audit Division (LAD) 
staff analyze the submission to provide recommendations for necessary action that 
may include: 


¢ Consideration of the information for future audits. 
e Gathering further information during an ongoing or routine audit. 
¢ Performing a separate investigation apart from a regular audit. 


* Following up with the attorney general regarding any criminal charges. 


The following penal violations were received from agencies and selected to be included 
in this report because of their impact to the state. 


Montana State University E-mail Scam 


Montana State University (MSU) reported an employee had responded to an e-mail 
scam. This employee purchased $2,500 of gift cards as a result of this scam. The MSU 
report indicated an employee received an e-mail that appeared to come from their 
supervisor. Ihe e-mail asked for the purchase of 25 $100 iTunes gift cards. The e-mail 
then instructed the employee to send the codes from the back of the cards via e-mail. 
A subsequent e-mail requested 20 additional cards, but the employee did not purchase 
the additional cards. Ihe report was also filed with the FBI Internet Crime Complaint 
Center and the University Police. The University Police responded and MSU Office 
of Audit Service determined the case was closed and no further action was necessary. 
MSU staff provided documentation of the complaint to the Internet Crime Complaint 
Center and the police report for review by LAD staff. 


Montana State University Student Financial Aid Activity 


An individual gained access to Montana State University’s (MSU) information system 
through a phishing attack and changed two students’ bank account numbers associated 
with their financial aid. This resulted in refunds of $1,330 and $2,166 being diverted 
from the students” bank accounts to the new bank accounts. A report was filed with 
the University Police by the students who did not receive their refunds. MSU then 
reported this incident to the Legislative Audit Division. 
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Audit staff worked with MSU staff to determine what actions were taken in response 
to this incident. MSU staff indicated they could not find any connections between 
the two students involved, and determined their credentials were stolen via a manual 
phishing attack. MSU issued a paper check to each student, ensuring they received 
prompt payment. Also, MSU alerted all students of the attack. MSU plans to send 
out e-mail notification when student bank profile information has been changed, 
and is reviewing the security awareness information and education on phishing to 
better inform students, staff, and faculty. To prevent this situation in the future, MSU 
staff are pursuing multi-factor authentication and are reviewing incident response 
procedures. It was determined by LAD staff that the university has taken appropriate 
steps to prevent further attacks. 


Fish, Wildlife, and Parks Hatchery 
Fish Food Fund Money Stolen 


A report was made regarding theft by a Fish, Wildlife, and Parks (FWP) employee of 
$80 from a petty cash fund. The public at the Big Springs Hatchery in Lewistown pays 
to feed the hatchery fish by using a fish food dispenser, similar to a gumball machine. 
Hatchery staff removed the cash from the dispenser when it was full and placed the 
cash in a bowl in the office. Staff would use that money to refill the dispenser with 
fish food. The employee admitted to the theft and was disciplined. “The incident was 
reported to the attorney general by FWP. 


LAD staff followed up on the incident to determine what changes were made to FWP 
policy to prevent this issue in the future. FWP indicated they made minor changes 
to procedures related to the fish food dispensers. EWP employees are now required 
to empty the money out of the fish food dispensers once a month. Two employees are 
now responsible for collecting, counting, and logging the money. Each FWP hatchery 
is required to develop a log for tracking funds, including tracking signatures of those 
who handled the money, date it was counted, and the amount. Also, the money must 
be taken to the bank the same day and converted into a cashier's check. 


Chapter V-Apparent Criminal 
Violation Referrals 


Introduction 


Section 5-13-304(4), MCA, requires our oflice report to the attorney general apparent 
violations of the penal statutes identified during audit work. During our audit entitled 
Governance Practices for Information Technology Investments (17DP-02) it came to our 
attention that two former state employees may have violated $2-2-201, MCA, which 
prohibits them from working for contractors they were directly involved with during 
their employment with the state. This law provides for a 6-month cooling-off period 
between termination of state employment and working for a state contractor. A 
violation of $2-2-201, MCA, provisions is a misdemeanor under $18-4-141(4), MCA, 
and could incur a fine of not less than $500 or more than $5,000. Additionally, the 
state of Montana may at its option declare any contract in violation of $2-2-201, MCA, 
void from the beginning of the contact. 


Section 2-2-201, MCA, states that: “A former employee may not, within 6 months 
following the termination of employment, contract or be employed by an employer 
who contracts with the state or any of its subdivisions involving matters with which the 
former employee was directly involved during employment.” We provided the attorney 
general a letter detailing the allegation as well as documentation which showed the 
employees did not wait the requisite 6-month period the statute requires. 


One employee terminated their employment in January 2018 and within the same 
month began working for a company with an ongoing contractual relationship with the 
state that began around 2012. Additionally, while employed with the state, this former 
employee was directly involved in the contractual relationship with this company. 


The second employee terminated their employment with the state in December 2017 
and within a month was working for a company with an ongoing contractual 
relationship with the state that began in 2015. As with the first employee, this person 
was also directly involved in the contractual relationship with the company during 
their employment with the state. 


Investigation 


The attorney general turned the investigation of the allegations over to the Department 
of Justice’s (DOJ) Division of Criminal investigation. The agent in charge of the 
investigation reviewed documentation provided by LAD staff, conducted interviews 
of the employees and department staff, prepared a case file, and presented the case file 
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to the Lewis and Clark County Attorney for consideration of criminal misdemeanor 
charges against the two individuals. 


Conclusion 


On June 26, 2018, the agent was informed by the Lewis and Clark County Attorney 
that he had decided not to file a criminal charge against either person because he did 
not “... believe a 12-person jury would unanimously agree beyond a reasonable doubt 
any law was violated.” Based on our review of the agent’s case file and conversations 
with the county attorney, a prosecution under the statute as currently written would 
require substantial resources where a guilty verdict is unlikely, and even if obtained, 
where the punishment would not serve as an effective deterrent to others. 


Potential Legislative Changes 


Based on the outcome of this referral and our discussions with DOJ and the Lewis 
and Clark County Attorney, the legislature could consider several different options 
for strengthening current state law relating to former employees working for state 
contractors. These changes could include the following: 


+ Clarifying statutory language and definitions to provide a more precise 
basis for assessing certain actions and relationships in the contracting and 
procurement processes. 


¢ Extending the cooling off period from 6 months to one year. This would 
provide for a more meaningful break in service and would also address 
the difference between contracting law and the State Ethics Code, which 
currently references a one-year period. 


¢ Strengthening the deterrent effect of the law by classifying the criminal 
violation as a felony, rather than a misdemeanor, and/or specifying a 
significant financial penalty. 


+ Mandating state contracts include specific acknowledgments or provisions 
relating to former state employees. 


